December 2014 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

No Logon Servers error with FreeRADIUS + NTLM
by Stefan Paetow 19 Feb '16

19 Feb '16

Hi, I know this is not a problem with FreeRADIUS, however, there are several people on this list who run FreeRADIUS with Active Directory as a back end and I need their advice on this. I've run into the dreaded "No logon servers (0xc000005e)" error with NTLM. In the past I've found that the computer password for the server expired on AD and that it was either fixed by rejoining, or by tweaking the password's expiry. Do any AD folk on the list know what we can do to get this stable and that this does not occur again? Any ideas will be very useful. :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

Different behaviour of 2.2.0 and 2.2.6 in handling Post-auth-type reject
by Wiesław Bieniek 31 May '15

31 May '15

Hello, I've used default server configured as follows: post-auth { # my module decides to allow or reject request rtdps2 Post-Auth-Type REJECT { attr_filter.access_reject } } When I run this on 2.2.0 I got debug: Thu Nov 27 14:28:44 2014 : Info: ++[rtdps2] returns reject Thu Nov 27 14:28:44 2014 : Info: Using Post-Auth-Type REJECT Thu Nov 27 14:28:44 2014 : Info: # Executing group from file ../etc/raddb/sites-enabled/default Thu Nov 27 14:28:44 2014 : Info: +- entering group REJECT {...} Thu Nov 27 14:28:44 2014 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testing Thu Nov 27 14:28:44 2014 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 27 14:28:44 2014 : Info: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 80 to 192.168.1.4 port 33304 Cisco-AVPair := "h323-return-code=8" Which is correct, but when I run it in 2.2.6 I got: Thu Nov 27 14:19:35 2014 : Info: ++[rtdps2] = reject Thu Nov 27 14:19:35 2014 : Info: +} # group post-auth = reject Sending Access-Reject of id 186 to 192.168.1.4 port 49975 Service-Type = 0 Framed-Protocol = 0 Cisco-AVPair := "h323-return-code=8" Thu Nov 27 14:19:35 2014 : Info: Finished request 0. Which is wrong, because attributes was not filtered out. Am I missing something ? Is this a bug ? What to do to make version 2.2.6 to work the same way 2.2.0 does ? Regards- *Wiesław Bieniek* <http://www.comarch.pl>

3 14

Fwd: Child is hung (max_request)
by srithar jeevadurai 25 Mar '15

25 Mar '15

Hi Team, We need your help to fix our radius server error. I kindly request you to help us on the same. We are facing 'Child is hung' message in our radius server and we have to restart radius server to become normal. As per our analysis the error message comes whenever there are more load on the server. *Configuration: * max_request_time = 30 cleanup_delay = 5 *max_requests = 12800* *max_queue_size = 131072* start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 Our system TPS is 100 (at max 120). Since we have kept max_request as 12,800 and max_request_time as 30 seconds, we will be able to support max backlog 3000 (TPS x max_request_time). That is our system can clear first 3000 requests in the queue before it faces 'time expire' (max_request_time). However we have set max_request as 12,800 during high load, system is facing 'child is hung' when the backlog grows more than 3000. Is our above understanding correct? If it is correct, we can resolve our issue by setting max_request as 3000 i.e. during high load, we will not face 'child is hung ' and no need to restart radius server to become normal. Looking forward for your reply. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

8 32

Re: Expansion of \t and \n in message with linelong module
by paul.moser＠bt.com 13 Mar '15

13 Mar '15

(apologies if I've broken the threading - I shouldn't have subscribed using digest mode, now corrected) On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > The reason is that attributes can have embedded \n in them, either as binary or a as a string "\n". Using those attributes in the "linelog" module would then cause spurious new lines, and break your assumptions about what the log files mean. Very good point. Because the set of attributes we happen to use in the log entry don't include end user inputted data and the source of those packets we are safe from unexpected expansion for now, but our future intended use and as a general use case this is certainly what's known as a bad idea. Time to rethink. >Not with 3.0.6. We can take a look at correcting it for the next release. We’ve made other fixes in 3.0 which made it easier to separate the "literal" strings passed in from the config files, and the “end user” strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. Certainly that would help, but I should probably the end result we are trying to achieve in case linelog was completely the wrong approach. It sound like we are doing much the same as Matthew Newton, in addition to performing some normal authentication/authorization/accounting we also send information from those to another radius server as accounting packet - in some cases this is for additional auditing, sometimes as it enables other functionality - using the linelog module we could write out a file in the standard detail format but with just the attributes we wanted (and the type as accounting even if it had originally been an access request), and use a detail listener to pick that up and send them on. Is there some other way to do this that I've missed? I suspect the reason in our case that accounting packets are always used is just because historically it was more convenient to do so. Given we own the systems that the packets get sent onto it's possible that we may be able to change those systems to handle access request or response packets as well as accounting, and modify the source systems to use a detail writer/read and Proxy-to-realm setup rather linelog Paul ------------------------------ Message: 2 Date: Tue, 23 Dec 2014 11:05:23 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <E5F57FCB-CC38-4386-B922-3F36D37A3F88(a)deployingradius.com> Content-Type: text/plain; charset=windows-1252 On Dec 23, 2014, at 10:38 AM, paul.moser(a)bt.com wrote: > I have a 3.0.3 FR instance to which some additional logging has been added using the linelog module. The log messages that are written are multi-line and tab indented with \n and \t used in the format option in the linelog modules configuration file. That?s not really the intended use of the ?linelog? module. It logs lines of text.. not multiple lines. > I have also tried migrating another, older (v2.x) FR instance to v3.0.6. I started with a vanilla 3.0.6 configuration and successfully slowly modified that to give the same behaviour as the v2.x version. However when I finally attempted to add the additional logging that had been added to the 3.0.3 instance the log statements appearing in the log file are not multi-line or tab indented, neither the newline \n nor the tab \t have been expanded, \n and \t appear in the log file where I'd expected newlines and tabs to appear. > > I note in the changelog that for v3.0.5 correct_escapes was introduced and in a vanilla 3.0.6 configuration this is set to true It?s correct, and it creates many other simplifications of the source tree. > Taking my 3.0.3 configuration as is and running it against a 3.0.6 server it behaves just as it does with a 3.0.3 server - expanding \t and \n . However if I modify the configuration to set correct_escapes to true then literal \t and \n appear in the log file rather than tabs and newlines. Yes. That?s really the correct behaviour. The reason is that attributes can have embedded \n in them, either as binary or a as a string ?\n?. Using those attributes in the ?linelog? module would then cause spurious new lines, and break your assumptions about what the log files mean. > With 3.0.6, with correct_escapes=true, is it possible to use backslash escape sequences, or some equivalent to format linelog log messages? Not with 3.0.6. We can take a look at correcting it for the next release. We?ve made other fixes in 3.0 which made it easier to separate the ?literal? strings passed in from the config files, and the ?end user? strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. > It maybe that the expansion of \n and \t in 3.0.3 was just undocumented behaviour that we stumbled upon and utilised rather than expected behaviour, the fact that the module is called line (singular) log may indicated we should not expect it to write multi-line log statements. Both. > I realise that I could just set correct_escapes=false in my 3.0.6 instances, I have briefly tried this however much of the default configuration now appears to assume the correct escapes and I'd have to unwind all those changes. I suspect if I did this I'd just be storing up trouble for myself some point in the future. I?d recommend keeping the new behaviour. It?s *much* more intuitive. Alan DeKok. ------------------------------ Message: 3 Date: Tue, 23 Dec 2014 23:27:27 +0000 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <20141223232727.GA19006(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=utf-8 On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > That?s not really the intended use of the ?linelog? module. > It logs lines of text.. not multiple lines. Of course, "intended" and "what's useful" are two different things. We're also (ab-)using linelog to write out detail log format. These are then picked up by the detail reader and fed (as accounting packets) across to a central RADIUS server for common logging. It means we can set exactly which attributes to forward. Because of the way the logging and detail reader works it is also reliable if the central server goes away for some reason. I guess the alternative would be to have an "include" option for the detail module, countering the "suppress" option. But that's only for our use case. > Not with 3.0.6. We can take a look at correcting it for the > next release. We?ve made other fixes in 3.0 which made it > easier to separate the ?literal? strings passed in from the > config files, and the ?end user? strings taken from a RADIUS > packet. We can have the linelog module convert \n -> CR for > literal strings you enter, but not do that expansion for > strings taken from RADIUS packets. That would seem the more sensible option - expand \n, \t etc in the string first, then expand %{..}. But I get that string expansion is pretty tricky in the ordering it needs to be done to get a sane output for all cases. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 4 Date: Tue, 23 Dec 2014 23:48:11 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>, Matthew Newton <mcn4(a)leicester.ac.uk> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <ABEC402F-CA0B-418A-A14F-C7F97692988B(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" buffered_sql with extra attr_filter rule? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 5

ipaddr, ipv4addr ipv6addr
by Arran Cudbard-Bell 06 Mar '15

06 Mar '15

The behaviour of the ipaddr config item has changed slightly for 3.0.4. If the ipaddr value contains ':' or '[' or ']', it will be treated as an IPv6 address. If it fails to parse as an IPv6 address the server will refuse to start. If the ipaddr value does not contain any ipv6 chars the server will first check to see if it looks like an ipv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else if a AAAA record is available else the server will refuse to start. If instead of the ipaddr config item the ipv4addr config item is used the server will check if it looks like an IPv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else the server will refuse to start. If instead of the ipaddr config item the ipv6addr config item is used the server will check if it looks like an IPv6 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching AAAA record is available it will be used, else the server will refuse to start. The behaviour is similar for the client, home_server and listen sections. Though those config items in client sections may have an optional /[0-9]{1,3} suffix to map clients to ranges of IP addresses. This should also work with things like example.org/96 though i'm not entirely sure why you'd ever want to do that. 'netmask' is now deprecated but will still function as expected until 3.1.0. These changes should make it slightly easier to manage v4/v6 transitions. Wildcard clients 0.0.0.0 <ipaddr>/0 '*' are not supported. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 15